{"id":"CVE-2026-67342","aliases":["GHSA-x8mg-6r4p-87pf"],"url":"https://o3.security/vulnerability/CVE-2026-67342","summary":"ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers","details":"About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler (which holds the only per-database gate at DatabaseAbstractHandler.java:69,88-90). Affected: PostBatchHandler:129, PostTimeSeriesWriteHandler:115, PostPrometheusWriteHandler:83, PostTimeSeriesQueryHandler:69, GetTimeSeriesLatestHandler:58, PostGrafanaQueryHandler:69, GetGrafanaHealthHandler:49, GetGrafanaMetadataHandler:52, GetPromQLQueryHandler:63, GetPromQLQueryRangeHandler:71, GetPromQLLabelsHandler:56, GetPromQLLabelValuesHandler:62, GetPromQLSeriesHandler:72, PostPrometheusReadHandler:85. The engine fallback is also void: LocalDatabase.checkPermissionsOnDatabase:711 early-returns when getCurrentUser()==null.\n\nExploit: a user authorized only for DB 'a' calls POST /api/v1/batch/b, POST /api/v1/ts/b/write, GET /api/v1/ts/b/prom/api/v1/query, POST /api/v1/ts/b/query -> full read AND write of DB 'b' (200 OK). The equivalent /api/v1/command/b correctly returns 403.\n\nFix: re-parent these handlers to DatabaseAbstractHandler, or add a shared resolveAuthorizedDatabase() choke point that enforces canAccessToDatabase and sets the engine principal before getDatabase(...). Fail closed when the security context is absent.","published":"2026-08-01T12:22:16.670Z","modified":"2026-10-25T02:30:28.158263137Z","cvss":null,"epss":{"score":0.00319,"percentile":0.24707,"asOf":"2026-09-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.arcadedb:arcadedb-server","fixedVersion":"26.7.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67342.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67342"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers"},{"type":"PACKAGE","url":"https://github.com/ArcadeData/arcadedb"},{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.7.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-25T02:30:28.158263137Z"}}